Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10425
- Critical
- 1916
- CISA KEV
- 79
- Public PoC
- 384
Most common types
- Broken Access Control 1290
- Privilege Escalation 1190
- Remote Code Execution 1111
- Authentication Bypass 835
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 416 of 695
- 9.9 /10 CriticalCVE-2026-82013 Auth required
Adobe Campaign Classic - Privilege Escalation
Adobe Campaign Classic contains a server-side request forgery caused by improper validation of URLs, letting low-privileged attackers escalate privileges by accessing internal resources, exploit requires no user interaction.
- 9.1 /10 CriticalCVE-2026-82011 Auth required
Adobe Campaign Classic - SQL Injection
Adobe Campaign Classic contains an SQL injection caused by improper neutralization of special elements in SQL commands, letting low-privileged attackers bypass security to gain unauthorized read and limited write access, exploit requires no user interaction.
- 9.9 /10 CriticalCVE-2026-82010 Auth required
Adobe Campaign Classic - SQL Injection
Adobe Campaign Classic contains an SQL injection caused by improper neutralization of special elements in SQL commands, letting low-privileged attackers execute arbitrary code, exploit requires no user interaction.
- 9.1 /10 CriticalCVE-2026-82009 Auth required
Adobe Campaign Classic - SQL Injection
Adobe Campaign Classic contains an SQL injection caused by improper neutralization of special elements in SQL commands, letting attackers with high privileges execute arbitrary SQL commands, exploit requires high privileges.
- 9.9 /10 CriticalCVE-2026-82008 Auth required
Adobe Campaign Classic - Remote Code Execution
Adobe Campaign Classic contains an improper input validation vulnerability that allows low-privileged attackers to execute arbitrary code in the context of the current user, exploit requires no user interaction.
- 8.5 /10 HighCVE-2026-82003
Adobe Campaign Classic - Remote Code Execution
Adobe Campaign Classic contains an improper input validation vulnerability that allows low-privileged attackers to execute arbitrary code in the context of the current user, exploit requires conditions beyond attacker control.
- 9.6 /10 CriticalCVE-2026-82000 Auth required
Adobe Experience Manager Forms JEE - Privilege Escalation
Adobe Experience Manager Forms JEE contains a server-side request forgery caused by improper validation of URLs, letting low-privileged attackers escalate privileges by accessing internal resources, exploit requires no user interaction.
- 8.7 /10 HighCVE-2026-81999 Auth required
Adobe Experience Manager Forms JEE - Privilege Escalation
Adobe Experience Manager Forms JEE contains a server-side request forgery caused by improper validation of URLs, letting attackers with high privileges escalate access to internal resources, exploit requires high privileges.
- 7.8 /10 HighCVE-2026-81998 No auth
Substance3D Modeler - Remote Code Execution
Substance3D Modeler contains an out-of-bounds write vulnerability caused by improper memory handling, letting attackers execute arbitrary code in the context of the current user, exploit requires victim to open a malicious file.
- 9.1 /10 CriticalCVE-2026-81995 Auth required
Adobe Experience Manager Forms JEE - Remote Code Execution
Adobe Experience Manager Forms JEE contains an improper input validation vulnerability that allows attackers with high privileges to execute arbitrary code in the context of the current user, exploit requires high privileges.
- 9.1 /10 CriticalCVE-2026-80156 Auth required
Lantronix SLC8000 - Path Traversal & Remote Code Execution
Lantronix SLC8000 < 9.7.0.5, EMG8500/EMG7500 < 9.7.0.1, and all versions of SLB882/SLCx-03/SLCx-02 contain a path traversal vulnerability in the web management portal upload endpoint, letting authenticated attackers write arbitrary data outside intended directories, leading to remote code execution.
- 10.0 /10 CriticalCVE-2026-80155 No auth
Lantronix SLC8000 - Authentication Bypass
Lantronix SLC8000 < 9.7.0.5, EMG8500/EMG7500 < 9.7.0.1, and all versions of SLB882/SLCx-03/SLCx-02 contain an authentication bypass caused by path traversal in the web management portal upload endpoint, letting unauthenticated attackers read sensitive files and upload arbitrary files leading to remote code execution, exploit requires crafted cookie value.
- 9.6 /10 CriticalCVE-2026-80154 No auth
Lantronix - Authentication Bypass
Lantronix SLC8000, EMG8500, EMG7500, SLB882, SLCx-03, and SLCx-02 firmware contain an authentication bypass caused by predictable session token generation and crafted URI exploiting file extension handling in web management portal, letting unauthenticated attackers bypass source IP and User-Agent validation to gain elevated privileges.
- 9.1 /10 CriticalCVE-2026-80152 Auth required
Lantronix SLC8000 & EMG8500/EMG7500 - Command Injection
Lantronix SLC8000 < 9.7.0.3, EMG8500/EMG7500 < 9.7.0.1, and all versions of SLB882/SLCx-03/SLCx-02 contain a command injection caused by unsanitized input in the set script schedule command, letting authenticated attackers with services permission execute arbitrary shell commands as root.
- 9.1 /10 CriticalCVE-2026-80151 Auth required
Lantronix SLC8000 - Command Injection
Lantronix SLC8000 < 9.7.0.3, EMG8500/EMG7500 < 9.7.0.1, and all versions of SLB882/SLCx-03/SLCx-02 contain a command injection caused by unsanitized input in the set nfs download command, letting authenticated attackers with services permission execute arbitrary shell commands as root.